From owner-freebsd-net@FreeBSD.ORG Tue Jun 30 19:40:02 2009 Return-Path: Delivered-To: freebsd-net@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 94089106566C for ; Tue, 30 Jun 2009 19:40:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 81D678FC13 for ; Tue, 30 Jun 2009 19:40:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n5UJe24D096573 for ; Tue, 30 Jun 2009 19:40:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n5UJe2l3096572; Tue, 30 Jun 2009 19:40:02 GMT (envelope-from gnats) Date: Tue, 30 Jun 2009 19:40:02 GMT Message-Id: <200906301940.n5UJe2l3096572@freefall.freebsd.org> To: freebsd-net@FreeBSD.org From: Mikolaj Golub Cc: Subject: Re: kern/134557: [netgraph] [hang] 7.2 with mpd5.3 hanging up - ng_pptp problem X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Mikolaj Golub List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 30 Jun 2009 19:40:02 -0000 The following reply was made to PR kern/134557; it has been noted by GNATS. From: Mikolaj Golub To: bug-followup@FreeBSD.org Cc: freebsd-net@FreeBSD.org, Sergei Cherveni , Alexander Motin Subject: Re: kern/134557: [netgraph] [hang] 7.2 with mpd5.3 hanging up - ng_pptp problem Date: Tue, 30 Jun 2009 22:33:12 +0300 --=-=-= Unfortunately, the problem was introduced by this commit :-) ---------- Author: mav Date: Sat Jan 31 12:48:09 2009 UTC (4 months, 4 weeks ago) Log Message: MFC rev. 187495 Check for infinite recursion possible on some broken PPTP/L2TP/... VPN setups. Mark packets with mbuf_tag on first interface passage and drop on second. PR: ports/129625, ports/125303 ---------- If a packet goes through two or more ng interfaces, "while" loop in the tag checking code can run infinitely. The attached patch should fix this. -- Mikolaj Golub --=-=-= Content-Type: text/x-diff Content-Disposition: attachment; filename=ng_iface.c.patch --- netgraph/ng_iface.c.orig 2009-06-30 21:47:54.000000000 +0300 +++ netgraph/ng_iface.c 2009-06-30 21:49:29.000000000 +0300 @@ -365,7 +365,8 @@ } /* Protect from deadly infinite recursion. */ - while ((mtag = m_tag_locate(m, MTAG_NGIF, MTAG_NGIF_CALLED, NULL))) { + mtag = NULL; + while ((mtag = m_tag_locate(m, MTAG_NGIF, MTAG_NGIF_CALLED, mtag))) { if (*(struct ifnet **)(mtag + 1) == ifp) { log(LOG_NOTICE, "Loop detected on %s\n", ifp->if_xname); m_freem(m); --=-=-=--